AVS Mismatch on a Legitimate Order
A real customer can fail the address check. Here are the innocent causes, how to read the code, and how to decide without turning away good buyers.
The order looks normal. Returning customer, sensible basket, a shipping address you have seen before. Then the dashboard flags an avs mismatch on the billing address.
Before you cancel it, slow down. AVS checks can fail on a legitimate order. The check is one signal, not a verdict.
What AVS actually checks, and what it doesn't
The Address Verification System is a service that checks if a billing address matches the address of a credit card cardholder. It gives you a way to check if the shopper placing the order is the same person as the cardholder.
It is a widely used fraud-prevention measure for card not present transactions, such as online payments or Mail Order/Telephone Order payments. It is supported for card payments with Visa, Mastercard, Discover or American Express.
It only looks at the billing address. It does not check the shipping address. Those are separate questions you answer yourself.
Why legitimate orders fail AVS
AVS checks can fail for legitimate payments. The innocent causes are boring and common.
Apartment numbers get typed as "Apt 4", "Unit 4" and "4". Sometimes the street address cannot be verified because of incompatible formats.
None of those mean the card is stolen. A postal code or CVC that does not pass can be a sign of fraud. A sign, not proof. Can, not does.
Reading the response code
Not every mismatch is the same mismatch. The avs response codes tell you how much of the address agreed.
In Adyen's docs, a result of 15 means the postal codes match but the street address was not verified because of incompatible formats. That is close to a pass. The customer got most of it right, and the format fought them.
A result of 22 means the card member's name matches but the billing address and billing postal code do not match. That one is weaker, and deserves a harder look at the rest of the order.
A response code of 3 means AVS is unavailable and applies to Discover. No answer is not a bad answer. You just have nothing to lean on.
Some codes apply to Visa, Mastercard, Discover and American Express, so read the code against the card on the order.
What to do when a good customer trips the check
Based on the AVS response, you can decide to accept, make an exception, or cancel a transaction. Those are your three options.
Start by verifying. Look at the order history. Has this customer bought from you before with the same card?
If the order is new and large, contact the customer before you ship.
Do not auto-cancel every mismatch.
Pairing AVS with other signals
Read the address result alongside every other detail on the order. A cvv check failed result on the same order is another signal to weigh. Shopify's guide says fraud indicators can include AVS checks and the correct CVV code, so treat them as a set.
For the wider picture, see card not present fraud prevention.
Setting up your mismatch handling
Using AVS is not mandatory for you as a merchant. You choose how much weight to give it.
In Adyen, when the AVS check results in a mismatch, you can trigger a risk rule.
One limit to know. In Adyen, AVS rules run after authorization, so it is not possible to link an AVS rule to Dynamic 3D Secure. Plan your rules with that order of events in mind.
Write your rule down and apply it the same way every time. Exceptions are fine. Random exceptions are not.
Reducing false mismatches at checkout
Gather the CVC, postal code, and billing address on every payment. That way the check always has data to work with. Ask for the billing address, not the shipping address, in the address field. Label it clearly.
The CVC is the three- or four-digit number printed directly on a card, and businesses can't store it, so collect it fresh each time.
Collecting these fields every time gives the checks something to compare.